UNITED STATES OF AMERICA
Federal Trade Commission
WASHrNGTON, D.C. 20580
Jessica L. Rich
Office of the Director
Bureau of Consumer Protection
April 10, 2014
Erin Egan
Chief Privacy Officer
Facebook, Inc.
1155 F Street, NW
Washington, DC 20004
[email protected]
AnneHoge
General Counsel
WhatsApp Inc.
303 Bryant Street, Suite 100
Mountain View, CA 94041
[email protected]
Dear Ms. Egan and Ms. Hoge:
I am sending you this letter in connection with Facebook, Inc.'s proposed acquisition of
WhatsApp Inc., a company that offers an instant messaging service with reportedly hundreds of
millions of users worldwide. 1 As you know, both companies collect data from consumers but
make different promises and statements with respect to consumers' privacy. In particular, and as
discussed in more detail below, WhatsApp has made a number of promises about the limited
nature of the data it collects, maintains, and shares with third parties -promises that exceed the
protections currently promised to Facebook users. We want to make clear that, regardless of the
acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the
acquisition is completed and WhatsApp fails to honor these promises, both companies could be
in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC's
order against Facebook.2
WhatsApp's Statements to Consumers Regarding Privacy
In its most recent privacy policy, dated July 7, 2012, WhatsApp makes several statements
about the types of data that it collects. It states that "WhatsApp does not collect names, emails,
1
This letter represents my views and does not necessarily represent the views of the Commission or any individual
Commissioner.
2
See In re Facebook. Inc., Decision and Order, No. C-4365 (2012), available at
http://www.ftc.gov/en forcementlcases-proceedings/092-3184/facebook-inc.
addresses or other contact information from its users' mobile address book or contact lists other
than mobile phone numbers ...." 3 It also states that "We do not collect location data" and that
"The contents of messages that have been delivered by the WhatsApp Service are not copied,
kept or archived by WhatsApp."4 The policy further represents that "We do not use your mobile
phone number or other Personally Identifiable Information to send commercial or marketing
messages without your consent . ..." Similarly, it states that "We do not sell or share your
Personally Identifiable Information (such as mobile phone number) with other third-party
companies for their commercial or marketing use without your consent." 5 WhatsApp's hundreds
of millions ofusers have agreed to use the WhatsApp service, and to have WhatsApp collect and
transmit their information, with the understanding that these promises will be honored.
Statements Made by WhatsApp and Facebook After the Purchase of WhatsApp
Following Facebook's announced intent to acquire WhatsApp, both companies have
made public statements indicating that the promises in WhatsApp privacy policies would be
honored. Following the announcement of the purchase, an article was placed on the WhatsApp
blog that stated:
Here's what will change for you, our users: nothing .... And you
can still count on absolutely no ads interrupting your
communication. There would have been no partnership between
our two companies if we had to compromise on the core principles
that will always define our company, our vision and our product. 6
Following the announcement of the proposed acquisition ofWhatsApp, Facebook chief
executive Mark Zuckerberg was quoted as saying "We are absolutely not going to change plans
around WhatsApp and the way it uses user data." 7 Similarly, a Facebook spokesperson stated
that "As we have said repeatedly, WhatsAfp will operate as a separate company and will honor
its commitments to privacy and security."
Future Uses of WhatsApp User Data
The statements in WhatsApp's privacy policy, combined with the recent public
statements by both Facebook and WhatsApp, constitute clear promises to consumers about the
collection and use of their data by WhatsApp and, following WhatsApp's purchase, Facebook.
As you know, the FTC has brought many cases alleging that the failure to keep promises made
3
WhatsApp Privacy Policy, July 7, 2012, available at www.whatsapp.convle!!al.
Id.
5 ld.
6
WhatsApp Blog, F acebook, February 19, 2014, available at blog. whatsapp.conu'index.php/20 14/02/facebook.
7
Jessica Guynn, "Mark Zuckerberg: WhatsApp worth even more than $19 billion," Los Angeles Times (February
24, 2014), available at http://www.latimes.com/business/technology/la-fi-tn-mark-zuckerberg-whatsapp-wortheven-more-than-19-billion-20 140224,0.603681 l.storv#axzz2vluc7 Aev.
8
Jessica Guynn, "Privacy Groups Urge FTC to probe Facebook's deal to buy WhatsApp," Los Angeles Times
(March 6, 20 14), available at http://www.latimes.com/business/technology/ la-fi-tn-privacy-groups-urge-ftc-toprobe-facebooks-whatsapp-deal-20 140306,0,5616080.story#axzz2 vEhEBQqd.
4
2
about privacy constitutes a deceptive practice under Section 5 of the FTC Act. 9 In addition, the
FTC has made clear that, absent affirmative express consent by a consumer, a company cannot
use data in a manner that is materially inconsistent with promises made at the time the data was
collected, and that such use of data could be an unfair practice under Section 5. 10
WhatsApp's privacy policy clearly states, among other things, that users' information
will not be used for advertising purposes or sold to a third party for commercial or marketing use
without the users' consent. Facebook' s purchase ofWhatsApp would not nullify these promises
and WhatsApp and Facebook would continue to be bound by them. Further, Facebook has
recently promised consumers that it would not change the way WhatsApp uses customer
information. Therefore, any use ofWhatsApp's subscriber information that violates these
privacy promises, by either WhatsApp or Facebook, could constitute a deceptive or unfair
practice under the FTC Act. Moreover, such an action could violate the FTC's order against
Facebook. Among other things, the Order enjoins Facebook and its subsidiaries from
misrepresenting the extent to which they maintain the privacy or security of consumers' personal
information and requires Facebook and its subsidiaries to obtain consumers ' affirmative express
consent before sharing their nonpublic information in a manner that materially exceeds any
privacy setting.
Before changing WhatsApp' s privacy practices in connection with, or following, any
acquisition, you must take steps to ensure that you are not in violation of the law or the FTC's
order. First, if you choose to use data collected by WhatsApp in a manner that is materially
inconsistent with the promises WhatsApp made at the time of collection, you must obtain
consumers' affirmative consent before doing so. Second, you must not misrepresent in any
manner the extent to which you maintain, or plan to maintain, the privacy or security of
WhatsApp user data. Failure to take these steps could constitute a violation of Section 5 and/or
the FTC's order against Facebook. 11 Finally, if you choose to change how you collect, use, and
share newly-collected WhatsApp data, we recommend that you offer consumers an opportunity
to opt out of such changes or, at least, that you make clear to consumers that they have an
opportunity to stop using the WhatsApp service.
9
See, e.g. , In re Gene/ink, Inc., File No. 1123095 (20 14) (proposed consent order), available at
http://www.ftc.gov/enforcementlcases-proceedings/112-3095/genelink-inc-matter; In re Upromise, Inc., Decision
and Order, No. C-4351 (20 12), available at http://www.ftc.gov/enforcementlcases-proceedings/l 02-3116/upromiseinc; In re Twitter, Inc., Decision and Order, No. C-4316 (2011), available at http://www.ftc.gov/enforcement/casesproceedings/092-3093/twitter-inc-corporation.
10
See In re Facebook, Inc. , Decision and Order, No. C-4365 (2012), available at
http://www.ftc.gov/enforcementlcases-proceedings/092-3184/facebook-inc.; In re Gateway Learning Corp.,
Decision and Order, No. C-4120 (2004), available at http://www.ftc.e:ov/enforcementlcases-proceedings/0423047/gateway-learning-corp-matter.
11
Violation of the order could subject the company to civil penalties of up to $16,000 per violation.
3
Hundreds of millions ofusers have entrusted their personal information to WhatsApp.
The FTC staff will continue to monitor the companies' practices to ensure that Facebook and
WhatsApp honor the promises they have made to those users.
~tcere~
Jessica Rich
Director
Bureau of Consumer Protection
4